I'm experimenting with almost exactly what you've outlined in the above article.

I am also using the website at the below link as a source for finding (potentially) offending ranges from (often) offending sources.

It's worth a shot.

I'm using some scripts based on netstat and whois lookups to determine frequent visitors from locations where my leash-holders don't do any business. Based on that, I'm able to remove the recent offenders.

If I see a pattern related to a particular ISP or location, then I use the below to DROP all ports that may offend.

http://www.proxyserverprivacy.com/ipaddress_range.php

Thanks,

sem